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The Freedom of Information Act 2000 (FOIA) gives rights of public 
access to information held by public authorities. 


An overview of the main provisions of the Act can be found in the 
Guide to Freedom of Information. This is part of a series of 
guidance, which goes into more detail than the Guide to FOIA to 
help public authorities to fully understand their obligations and to 
promote good practice. 


This guidance explains when a public authority can respond to a 
freedom of information request by refusing to confirm or deny that 
information is held to avoid disclosing exempt information. This is 
often called a ‘neither confirm nor deny’ (NCND) response. 
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Overview 


In certain circumstances, even confirming or denying that requested 
information is held can reveal information that falls under an 
exemption. A public authority may be able to use an exemption to 
refuse to confirm whether or not it holds information, if either 
confirming or denying would reveal exempt information in itself. 


A neither confirm nor deny response is more likely to be needed for 
very specific requests than for more general or wide ranging 
requests. 


It can be important to use a neither confirm nor deny response 
consistently, every time a certain type of information is requested, 
regardless of whether the information is actually held or not. For this 
reason public authorities need to be alert to the possibility of 
receiving future requests for the same type of information when 
handling very specific or detailed requests. 


Why use a ‘neither confirm nor deny’ response 


Section 1(1)(a) of FOIA requires a public authority to inform a 
requester whether it holds the information specified in the request. 
This is known as ‘the duty to confirm or deny’. In most cases, a 
public authority will be able to comply with its duty to confirm or 
deny under section 1(1)(a) -in other words, it will be able to 
respond to a request by at least informing the requester whether or 
not it holds the information. In most cases where information is 
held, a public authority will go on to consider whether information 
should be provided under section 1(1)(b), or whether it is subject to 
an exemption in Part II of the Act. 


However, there may be occasions when complying with the duty to 
confirm or deny under section 1(1)(a) would in itself disclose 
sensitive or potentially damaging information that falls under an 
exemption. In these circumstances, the Act allows a public authority 
to respond by refusing to confirm or deny whether it holds the 
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requested information. This is called a ‘neither confirm nor deny’ 
(NCND) response. 


A public authority can only refuse to confirm or deny whether it 
holds the information, if this would in itself reveal information that 
falls under an exemption. Public authorities should take decisions to 
neither confirm nor deny whether information is held in a similar 
manner to decisions to refuse to disclose information. A public 
authority must be certain that an exemption in the Act applies in 
respect of the confirmation/denial, and where an exemption is 
qualified by the public interest test, that the public interest favours 
neither confirming nor denying that the information is held. 


For many requests that public authorities receive, their decision to 
use a neither confirm nor deny response won't be affected by 
whether they do or don’t in fact hold the information. The starting 
point and main focus in most cases will be theoretical considerations 
about the consequences of confirming or denying that a particular 
type of information is held. The decision to neither confirm nor 

deny is separate from a decision not to disclose information and 
needs to be taken entirely on its own merits. 


What FOIA says 


All but one of the exemptions (section 21) in Part II of FOIA include 
a specific provision which removes the duty to comply with section 
1(1)(a) if confirming or denying information is held would reveal 
information that the exemption protects. If there is no duty to 
comply with 1(1)(a), a public authority does not have to go on to 
consider any exemptions from 1(1)(b) in relation to any information 
that may be held. 


When and how public authorities can use a neither confirm nor deny 
response differs according to the exemption being claimed, but 
neither confirm nor deny provisions usually cross reference an 
equivalent section 1(1)(b) provision. Public authorities should be 
able to explain which comparative 1(1)(b) provision is relevant and 
why the exclusion from the duty to confirm or deny is needed. 


Public authorities won’t need to claim an exclusion from the duty to 
confirm or deny whether information is held as often as they use 
the equivalent exemptions under section 1(1)(b). This is because, in 
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most cases, confirming that information is held will not reveal 
anything prejudicial or sensitive. 


The public interest test 


Section 2(1) of the Act provides that: 


‘Where any provision of Part II states that the duty to confirm 
or deny does not arise in relation to any information, the 
effect of the provision is that either - 


(a) the provision confers absolute exemption, or 


(b) in all the circumstances of the case, the public 
interest in maintaining the exclusion of the duty to 
confirm or deny outweighs the public interest in 
disclosing whether the public authority holds the 
information, 


section 1(1)(a) does not apply.’ 


Essentially, for qualified exemptions (those subject to the public 
interest test), the public interest has to weigh in favour of neither 
confirming nor denying that information is held. For more advice, 
see our more detailed guidance on the Public Interest Test. 


Prejudice based exemptions 


When responding to a request by refusing to confirm or deny under 
a prejudice based exemption, a public authority should demonstrate 
what prejudice (relevant to the particular interest that the 
exemption relates to) would, or would be likely to, arise from 
complying with s1(1)(a). Public authorities are not required to 
consider what prejudice would, or would be likely to arise from 
complying with section 1(1)(b) (providing the information). They 
will however need to explain which limb of the comparative section 
1(1)(b) provision is relevant to the exclusion from the duty to 
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confirm or deny. For more advice on the prejudice based 
exemptions, see our more detailed guidance on the Prejudice Test. 


Section 26(1) provides that: 


‘Information is exempt information if its disclosure under this Act 
would, or would be likely to, prejudice— 


(a) the defence of the British Islands or of any colony, or 


(b) the capability, effectiveness or security of any relevant 
forces’ 


Section 26(3) provides that 


‘The duty to confirm or deny does not arise if, or to the extent 
that, compliance with section 1(1)(a) would, or would be likely 
to, prejudice any of the matters mentioned in subsection (1).’ 


Example 


If, during wartime, a request were made to a government 
department for information regarding a particular battle plan then, 
merely confirming or denying that this information was held would 
reveal whether such a battle plan did or did not exist. If knowing 
that fact would assist an enemy and therefore prejudice the 
capability, effectiveness or security of relevant forces such as the 
armed forces, then the exclusion from the duty to confirm or deny 
whether this information was held could be validly claimed. In this 
situation, the nature of the information would probably mean that 
the public interest test would weigh in favour of neither confirming 
nor denying. 


See the guidance on Section 26: defence for more detail on 
applying this exemption. 
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Class based exemptions 


The exclusion from the duty to confirm or deny under class based 
exemptions (those that protect specific types or categories of 
information) varies according to the section being claimed. The 
provisions that remove the duty to comply with section 1(1)(a) 
under a class based exemption may apply in three circumstances: 


e Whenever the information is exempt, or would be if it 
were held 


Example 


Section 30(3) provides that the duty to confirm or deny does not 
arise in relation to information which is exempt information by 
virtue of subsection 30(1) or (2) (or would be if it were held by the 
public authority). 


A request for information which is or would be exempt information 
under section 30 (information held for the purposes of criminal 
investigations) would engage the exclusion from the duty to confirm 
or deny. 


For example, a police force may hold information regarding 
particular properties they have under surveillance - it is likely that if 
a request were made for information about the surveillance of a 
certain property, this information would be exempt under section 30 
(investigations and proceedings conducted by public authorities). A 
public authority could therefore refuse to confirm or deny whether it 
holds information about a property under surveillance. 


Furthermore, this would apply even if information was requested 
about a property not under surveillance. If a police force only 
upheld its duty to confirm or deny where it was not keeping 
properties under surveillance, an applicant could reasonably assume 
that where the police force refused to confirm or deny, the property 
named in the request was under surveillance. Section 30 is a 
qualified exemption (ie it is subject to the public interest test). The 
arguments used to engage the exclusion from the duty to confirm or 
deny would also be strong arguments in favour of maintaining the 
exclusion when it comes to the public interest test. 


See the guidance on Section 30: investigations and proceedings for 
more detail on applying this exemption. 
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e If confirmation /denial would disclose exempt information 


Example 


Section 42 (legal professional privilege) only permits the authority 
to refuse to confirm or deny whether information is held if this 
would itself reveal information (including unrecorded information) 
which is subject to legal professional privilege. 


If a public authority received a request for “any legal advice you 
have received about XYZ Ltd”, it would have to confirm whether or 
not it held such advice. A public authority could only refuse to 
confirm or deny if the request required them to reveal something 
about the content of the advice that would be covered by legal 
professional privilege. A neither confirm nor deny response could be 
given if a request was made for “any legal advice you have received 
which confirms that XYZ Ltd was acting illegally”. Confirming that 
such information was held would reveal that the public authority 
had advice that said XYZ Ltd was acting illegally. 


e When it is based on the same test as in the exemption 


Example 


Section 41 provides an absolute exemption for information provided 
in confidence. If to confirm or deny the holding of that information 
would itself constitute an actionable breach of confidence, then the 
duty to confirm or deny does not arise. In many cases, it will be 
possible to confirm or deny the holding of information without 
breaching a duty of confidence. 
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Practical considerations when using a neither confirm nor 
deny response 


When applying a neither confirm nor deny provision under any 
exemption, a public authority is not restricted to only considering 
the consequences of the actual response that it would be required 
to provide under s1(1)(a). For example, if it does hold the 
information, the public authority isn’t limited to only considering 
what would be revealed by confirming it has the information - it can 
also consider the consequences if it had to deny the information 
were held. 


It is sufficient to demonstrate that either a hypothetical 
confirmation or denial would engage the exemption. In other words, 
it is not necessary to show that both confirming and denying 
information is held would engage the exemption from complying 
with section 1(1)(a). 


Example 
The Financial Services Agency (FSA) receives a request: 


“Please provide any information on complaints about 
inadequate cash reserves within Bank X last year”. 


The FSA can provide a neither confirm nor deny response 
under section 43(3) by virtue of s43(2), on the basis that to 
confirm that complaints had been made against Bank X would 
prejudice Bank X’s commercial interests, even though denying 
it received any such complaints would have no effect. It does 
not matter whether the FSA actually hold the information. 


The wording of the request 


The exact wording of the request for information is an important 
consideration when deciding whether a public authority should 
confirm or deny if it holds the requested information. The more 
specific the request, the more likely it is that a public authority will 
need to give a neither confirm nor deny response. 
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Example: 
The Financial Services Authority receives a request: 


“Please send me a copy of all the complaints about banks 
made to you in the last six months.’ 


In this situation, it is unlikely that a NCND response will be 
needed. This is because the wording of the request is broad 
and confirming or denying whether some information falling 
within this wide category of information is held is unlikely to 
reveal anything that is damaging. 


Information in the public domain 


In some cases, it may be already known or obvious that information 
must be held, and in those circumstances confirming that 
information is held may not cause any harm (although, technically, 
it may still be possible to neither confirm nor deny if a relevant 
exclusion applies). When considering what a confirmation or denial 
would reveal, a public authority isn’t limited to considering what the 
public may learn from such a response; if it can demonstrate that a 
confirmation or denial would be revealing to someone with more 
specialist knowledge, this is enough to engage the exclusion to 
confirm or deny. 


Using the neither confirm nor deny response consistently 


There are situations where a public authority will need to use the 
neither confirm nor deny response consistently over a series of 
separate requests, regardless of whether it holds the requested 
information. This is to prevent refusing to confirm or deny being 
taken as an indication of whether information is held. Before 
complying with section 1(1)(a), public authorities should consider 
both whether any harm would arise from confirming that 
information is held and whether harm would arise from stating that 
no information is held. Otherwise, if the same (or same type of) 
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requests were made on several occasions, a changing response 
could reveal whether information was held. 


Example: 


A public authority receives a request for information about 
any prisoners who are under surveillance. The public authority 
judges that it would not be harmful to confirm that they hold 
information about this topic. However, if they did not hold 
such information, then revealing this could be harmful as it 
would confirm to prisoners that they were not under 
surveillance. Therefore, whether or not information is held, 
the authority should refuse to confirm or deny. 


If the public authority doesn’t take this consistent approach 
then the occasions when it provides a neither confirm nor 
deny response may unintentionally imply whether or not 
information is held. For example, 


Request 1: public authority confirms information is held; 
Request 2: public authority confirms information is held; 
Request 3: public authority states that it can neither 
confirm or deny that the information is held (the 
information is in fact not held); 

Request 4: public authority confirms information is held. 


Although the public authority hasn’t actually denied that 
information is held for request 3, the different response could 
be interpreted as indicating that this is the case. 


This does not mean that public authorities should use a neither 
confirm nor deny response in a blanket fashion. For example, a 
particular public authority should not provide a neither confirm nor 
deny response to all requests for all records because some of their 
records contain sensitive information. They should base their 
decision on the circumstances of the particular case, with regard to 
the nature of the information requested and with appropriate 
consideration given to the public interest test. 


Using a neither confirm nor deny response to avoid 
identifying the type of information held 


In some limited circumstances, while a public authority could 
technically use an NCND provision, it may feel that no harm would 


10 
When to refuse to confirm or deny information is held 
20131218 
Version:1.1 


be caused if it responded to a request by confirming that 
information is held, but it may wish to refuse to provide any further 
detail on the type of information that is held. While this situation is 
unlikely to arise very often, the ICO accepts that a public authority 
could use an NCND provision to refuse to confirm any detail about 
the information it holds. 


Example 


In the ICO decision notice FS50225088, the Ministry of Justice 
claimed s42(1) and section 35(3) in relation to a request for legal 
advice on the interpretation of the 1949 Marriage Act in relation to 
the marriage of Prince Charles and Camilla Parker-Bowles. While the 
Ministry of Justice confirmed that it held information relevant to the 
request and that it was exempt under s42(1), it also cited section 
35(3) by virtue of section 35(1)(c) in order to refuse to confirm or 
deny whether the information held was advice provided by law 
officers. As the exemption provided by section 35(3) was engaged, 
the Commissioner found that the public authority had complied with 
the Act. Whilst this might seem unusual, it allowed the public 
authority to maintain a consistent approach in its use of the NCND 
provision to not disclose whether law officers’ advice has been 
sought on a subject, should the public interest favour this approach. 


Using a neither confirm nor deny response without first 
establishing whether the information is held 


As stated above the main focus in NCND cases will usually be 
theoretical considerations about the consequences of disclosure. 
For prejudice based exemptions, public authorities will often have 
sufficient knowledge of the context of the request and the issues 
involved to fully consider the consequences of confirming or denying 
without first establishing whether the requested information is in 
fact held and without reviewing its content. For class based 
exemptions however, public authorities may find it will assist them 
to review any information that is actually held in order to establish 
for certain whether it falls within the scope of the exemption 
claimed. 
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Public authorities should however bear in mind that in either 
scenario the ICO might ask for confirmation of whether the 
information is in fact held, and may even require a copy of it in 
certain cases, if it considers that this would assist in the ICO 
investigation. 


Providing a neither confirm nor deny response to an 
applicant 


When a public authority refuses either to disclose requested 
information or confirm or deny that that information is held, it must 
issue a refusal notice stating the fact of refusal, the exemption used 
and why the exemption applies. 


A public authority should be clear in its refusal notice that where the 
public interest test applies, it has balanced the arguments in favour 
of maintaining the exemption (ie in favour of giving a neither 
confirm nor deny response) with the factors in favour of informing 
the applicant whether it holds the information. 


A neither confirm nor deny response needs to be worded carefully 
to avoid revealing exempt information. 


Other considerations 


You might also want to consider the more detailed guidance in 
respect of the exemptions that are referenced above. 


This guidance relates only to FOIA. If the information is 
environmental, public authorities will instead need to refer to the 
position under the EIR in our Guidance Index. 


However we have separate guidance: Neither confirm nor deny in 
relation to personal data which covers both section 40(5) of FOIA 
and regulation 13(5) of the EIR. 


More information 


This guidance has been developed drawing on ICO experience. 
Because of this, it may provide more detail on issues that are often 
referred to the Information Commissioner than on those we rarely 
see. The guidance will be reviewed and considered from time to 
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time in line with new decisions of the Information Commissioner, 
Tribunals and courts. 


It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 


If you need any more information about this or any other aspect of 


freedom of information or data protection, please Contact us: see 


our website www.ico.gov.uk. 
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